Malware authors are continuing to bombard unsuspecting PC users with fake anti-virus that’s designed to scare them into purchasing the fake software, thus handing over their identities on a “silver platter”.
Seeing how successful rogue anti-virus has become malware authors are broadening their collection of fake software. The latest fake software to scare and swindle PC users are fake system utilities.
These fake system utilities are exactly the same as the rogue anti-virus applications in the following ways:
- they get installed to the currently logged on user’s profile (usually in a hidden folder)
- folder names are random letters and/or numbers
- single .exe, again using random letters and/or numbers (rarely, they will use a fake name like “microsoft network service” for example)
- set to load at boot time (observed via looking at msconfig)
- modifies .exe registry entries (double clicking any .exe loads the rogue instead)
- rootkits may or may not be present
Here are the steps I took to remove the HDD Diagnostic Rogue:
- Reboot the computer into UBCD4Win Environment
- Replace Beep.sys with a legit, un-patched one.
- Manually deleted the rogue from the users temporary folders (malwarebytes did NOT detect this rogue).
- Ran a few regedit commands to fix the .exe associations.
- Installed Kaspersky Internet Security for user.
Below are some screen shots of the HDD Diagnostic Rogue…
The HDD Diagnostic Rogue
Fake Warnings To Scare Users
More fake messages
No hard drive activity at all
Please activate your software = give your cash and ID
Rogue Location
Rootkit that prevents anything from running except the rogue
